[otabdeveloper4]

> zero improvement on end-user experience

The end-user experience is that now you can host your Debian binaries in caches and CDNs without worrying about supply chain hackers.

You can verify that file hashes match the ones on Debian's website and sleep much better at night.

If you don't trust Debian's website then you can rebuild yourself and check if Debian has been compromised.

[tremon]

You could already do that since Debian cryptographically signs all its package indexes, and the indexes contain the hash of all packages. The additional guarantee that reproducible builds bring is that you can re-build the packages in your own controlled environment and verify that the resulting package is bit-for-bit identical to what Debian offers.

[otabdeveloper4]

Cryptographic signatures only protect against MitM (something extremely rare in the real world) and do nothing against compromised Debian infrastructure and supply chains (the real attack vector 99% of the time).

Reproducible builds protect against all attacks.

[tremon]

> Reproducible builds protect against all attacks.

Generic statements like this are always false. As a simple rebuttal, reproducible builds do not protect against source-level attacks such as intentional backdoors or disabled/obfuscated access checks. In fact, I'd say that reproducible builds protect against one class of attacks only: compromise of the build infrastructure.